Korea Energy Business Platform

Terms of Service for Online Business Platform

Chapter 1. General Provisions

Article 1 (Objective)

These Terms of Service aim to specify the rights·obligations and responsibilities of the Korea Energy Agency (hereinafter referred to as "the Agency") and users in using a range of online Korean and foreign marketing and export support services (hereinafter referred to as "Services") provided by the online business platform (hereinafter referred to as "the Platform") built and run by the Agency.

Article 2 (Definitions)

Words used in these Terms of Service are defined in Paragraphs below, and words that are not defined herein are defined in separate Terms of Service or Terms of Use for individual Services. ① "Online Business Platform" covers Korean, English and mobile versions of the website (http://www.koreaenergy.kr) operated to support online export and transactions of energy SMEs‧mid-sized companies in Korea. ② Users: This refers to those who are assigned a username (ID) after signing Platform User Agreement pursuant to these Terms of Service and use Services provided by the Platform, and include Korean SMEs‧mid-sized companies, buyers in Korea and abroad, etc. · Korean users (Vendors) : This refers to users that are SMEs as defined by the Framework Act on Small and Medium Enterprises and mid-sized companies as defined by the Act on Middle-Standing Enterprises, engaged in business areas under support (energy sector), that can use Services provided on the Platform. · Korean and foreign buyers (Buyers) : This refers to users based in locations in Korea and abroad who signed up to purchase or distribute goods registered on the Platform and who can use Services such as goods search and transaction inquiry. ③ Account (ID) : This refers to a combination of letters and numbers set by the user and approved by the Agency for identification of users and their service use, and a user shall use only one username by rule. ④ Password : It refers to a combination of letters and characters set by the user to authenticate that the user matches the user account and to protect the user's secrets in communications. ⑤ Post : It refers to informational texts in forms including signsㆍlettersㆍvoicesㆍsoundsㆍimagesㆍvideos, photos, videos, files and links, purchase inquiries, etc. posted by users on the Platform while using Services. ⑥ Any word or term not defined in this Article shall follow provisions in the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (hereinafter referred to as "Information and Communications Network Act.")

Article 3 (Effectuation and Change of Effect)

① These Terms of Services takes effect by the Agency posting the content on the Platform. ② The Agency may decide and announce in advance terms and conditions that apply in relation to particular Services (hereinafter referred to as "Individual Terms of Service") as necessary. In the event that there are such separate Terms of Service for specific or particular Services in relation to the service use, the effect of such terms takes precedence over these Terms of Service. ③ In the event of revising "Terms of Service" or "Individual Terms of Service," the Agency shall post an announcement that states the ground of revision, application date of revision, etc. on the Platform from 7 days in advance of the application date until the day immediately preceding the application date. However, any revision that has a material impact on users' rights and obligations shall be announced by at least 30 days in advance of the application date. ④ Terms of Service revised pursuant to Paragraph 2 of this Article shall also apply to users who signed User Agreement before the revision, and "Users" shall be deemed to have agreed to the revised Terms of Service upon visiting the Platform and using related "Services" after the effective date. ⑤ The Agency shall not be liable for damages to users arising from not knowing information about revised Terms of Service despite the announcement made pursuant to Paragraph 4. ⑥ If "Users" do not agree with the revised Terms of Service, they may terminate User Agreement and request for deletion of registered information.

Article 4 (Provisions Applicable Mutatis Mutandis)

Matters not specified in these Terms of Service shall be subject to related statutes such as the Framework Act on Telecommunications, Telecommunications Business Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., etc.

Chapter 2. Service User Agreement

Article 5 (Formation of Service User Agreement)

Service User Agreement is formed by the Agency's approval of the user's request for use and user's consent to the Terms of Service.

Article 6 (Application for Use)

Users may file an application for use online by filling out required fields in the User Membership Application form provided by the Agency. Any and all information of users entered in the online User Membership Application form shall be deemed to be real data, and any user who does not enter real name or real information shall not be protected by law and may face restrictions in service use.

Article 7 (Approval of Application for Use)

① The Agency may approve the application for use if all fields in the User Membership Application as provided in Article 6 have been accurately entered, and if the requirements set by the Agency such as continuous business activities in energy sector such as energy efficiency and renewable energy, etc. are met. ② However, the Agency may defer approval of appplication for use if any of the following is applicable. 1. In the event that information and communications facility lacks resources or has technical issues 2. In the event that a child below the age of 14 did not get consent from legal representatives such as parents, etc. 3. In the event that approval of use is difficult due to other circumstances ③ The Agency may reject the application for use in the event that the applicant has a history of breaching these Terms of Service or related statutes, the application for use violates these Terms of Use, or if any of the following is applicable. 1. In the event that false information was entered in application for use 2. In the event that the application was made with stolen business registration number of another company 3. In the event that the applicant was reported by another member on the Platform or others for illegal acts such as fraud, etc. 4. In the event that the same person whose User Agreement was terminated due to violation of Terms of Service pursuant to Article 16 reapplies for use 5. In the event that the applicant is a company debarred or suspended by the Public Procurement Office for unfair practices, or restricted from participation in the Agency's projects 6. In the event that other requirements for application are not met

Article 8 (Revisions to Terms)

Users may directly make revisions online or request revisions in the event of any changes in information entered during application for use such as personal information, etc.

Article 9 (Assignment and Management of Username)

① Users shall use only one username by rule. ② The member who owns the username is entirely responsible for all management of the username and password. The Agency shall not be liable for any loss or damages arising from leakage, transfer, rental or other mismanagement of the username or password that is not due to the act of the Agency. ③ For safe management of the username and password, users shall take the following measures. Users shall be entirely liable for any consequences of not fully complying with the measures. 1. Upon recognizing that the username or password has been stolen or is being used by a third person, users shall promptly report to the Agency and follow its instructions, if any. 2. Users shall check that the account is logged off after using the Services. 3. Users shall not tell a third person their username or password, or let a third person use them without a justifiable reason. ④ Users shall implement thorough username management inside the company in order to prevent any leakage or revision of significant company information in advance. The Agency shall not be liable for any damages caused to the company by service use, etc. due to mismanagement of user's employees or username. ⑤ Username shall not be shared or transferred. The Agency may suspend the use of username when its user shares or transfers username without prior consultation with the Agency.

Chapter 3. Obligations of Contracting Parties

Article 10 (Agency's Obligations)

The Agency shall protect users' personal information as provided by related statutes and the Agency's privacy policy, and shall not leak or distribute users' identity or personal information, including registered information, to a third person without their consent. However, this does not apply in the event of a request from a national institute pursuant to legal regulations such as the Framework Act on Telecommunications, etc. or a request for purposes of crime investigation, or a request pursuant to other procedures set forth in related statutes.

Article 11 (Users' Obligations)

① Users shall comply with what is set forth in these Terms of Service and related statutes. Also, users shall comply with restrictions of use in separate Terms of Service announced or posted for specific or particular Services in relation to the use of Services. ② Users shall engage in the following acts when using Services. 1. Act of unfairly using another user's username 2. Act of reproducing, publishing or providing to a third person any information obtained from Services 3. Act of violating rights including the Agency's copyright, a third person's copyright, etc. 4. Act of distributing content that violates public order or morals 5. Act that is objectively recognized to be tied with a criminal activity 6. Act that infringes upon other related statutes 7. Act of requesting change to a user of a company that is substantially irrelevant to him/herself by stealing another company's business registration number, etc. 8. Act of continuously sending promotional information against the recipient's will, sending and receiving large volumes of materials or uploading posts that may cause disruptions in stable operation of Services, and other acts that go against sound service use 9. Act of interfering with Services offered by the Agency 10. Act of registering goods without intention to actually sell the goods ③ Users shall not engage in sales activities using Services and the Agency shall not be liable for any consequences as a result of users engaging in sales activities that violate Terms of Service. ④ Users shall not transfer or grant the right to use Services or other status on User Agreement to a third person nor shall provide it as a collateral.

Chapter 4. Service Use

Article 12 (Users' Management and Deletion of Posts)

① The Agency may limit the users' memory space, message size, number of days of storage, etc. for efficient service operation. The agency shall have the right to edit or move registered content on the Platform without prior notification, and may delete content without prior notification if any of the following is applicable. 1. In the event that it slanders or defames another user or a third person 2. In the event that it violates public order or morals 3. In the event that it is recognized to be tied with criminal activities 4. In the event that it infringes on the Agency's copyright, a third person's copyright (trademark right, portrait right, etc.) or other rights 5. In the event that it does not correspond to the nature of Services or is posted redundantly 6. In the event that it contains false or exaggerated advertisement 7. In the event that the posted content has been reported with specific grounds to violate the interests of other users through Internet fraud, etc. and the report is recognized as valid based on a reasonable doubt 8. In the event that it causes malfunction of information and communications facilities or include computer virus or data that causes confusion 9. In the event that a user posts obscene materials or links to pornographic websites on his/or her community or bulletin 10. In the event that it is found to breach other related statutes ② The publisher of the post shall be liable for all civil and criminal liabilities including copyright infringement arising from images, texts, and videos (including attached files) in the post and the Agency shall not be liable for the above. ③ The copyright of posts registered on the Platform belong to the publisher as long as it does not violate a third person's rights. Publication right within the Platform belongs to the Agency. ④ The Agency may expose posts by users on search portals or related websites, and may use them for promotional, advertising or other materials free of charge. Also, the Agency may reproduce, display, transmit or distribute users' posts within Services provided by the Agency and may create secondary works or edited works. However, upon the request of the post's publisher to delete or stop the use of the post, the Agency shall promptly delete or stop the use of post except for any items to be preserved pursuant to related statutes. The copyright and intellectual property right of any works created by the Agency or management company shall belong to the Agency. ⑤ In the event that the information posted or registered on the Platform by a user corresponds to information that infringes upon others' rights such as violation of privacy, defamation, violation of copyright and intellectual property right, etc. (hereinafter referred to as "infringing information') and the person who has been infringed upon requests the Agency to delete the infringing information or publish a refuting post by explaining the fact of infringement, the Agency shall take necessary measures without delay such as deletion of infringing information, temporary denial of access within a 30-day period (hereinafter referred to as "temporary measure"), etc.. This shall also apply in the event that the Agency finds information to be infringing information on its own. In the event that the Agency took necessary measures related to infringing information, the Agency shall promptly notify this to the person who made the request and the publisher of infringing information. In the event that the user whose published or registered information has been deleted or subject to temporary measure requests the Agency to recover the deleted information, suspend temporary measure, etc. by presenting an agreement among parties in dispute or a conclusive report which can prove that the corresponding information is not infringing information, or other sufficient evidence that the information that has been deleted or subject to temporary measure is not infringing information, the Agency may respond to the request.

Article 13 (Service Use Time)

Service use is available year around and 24 hours a day in principle unless there are any particular operational or technical problems. However, service use is not available during routine inspections, etc.

Chapter 14 (Content of Service)

① Company : provides company address, representative, contact information, website, etc.
② Product : introduces images, specifications, functions, etc. of products registered by each user
③ Buyer : can see the company name, nationality, area of interest, etc.
④ Other transaction-related support services provided on the 'Platform'
⑤ Content of service is decided by and may be subject to change according to the Agency's policies.

Article 15 (Liability for Service Use)

Users shall not engage in acts such as hacking, publishing links to pornographic websites, or illegal distribution of commercial S/W using Services, and the Agency shall not be liable for any consequences, losses, legal actions of related institutions, etc. arising from any violation of the above.

Article 16 (Suspension of Service Provision)

① All of part of Services may be restricted or suspended if any of the following is applicable, and in such event, the Agency shall not be held liable by service users or third persons for discontinuing the provision of Services. 1. In evitable circumstances of the Agency such as repair of service facilities, etc. 2. In the event that facilities-based telecommunications business entity as provided in the Framework on Telecommunications suspends its telecommunications services 3. In the event that normal service provision is rendered impossible due to national emergency, blackout, failure of service facilities, explosive increase in service use, etc. 4. In the event that system inspections are required 5. In other events of force majeure ② In the event that messages stored or transmitted on the Platform or other communications messages, etc. have not been stored, sent or have been deleted due to national emergency, blackout, service facility malfunction beyond the scope of website management, or other force majeure, or other communications data has been lost, the Agency shall not be liable.

Chapter 5. Contract Termination and Restriction of Use

Article 7 (Contract Termination and Restriction of Use)

① In the event that a user wishes to terminate the User Agreement, the user shall request termination online and the Agency shall respond after authenticating the user. In such event, the same person may rejoin as a user according to the user membership procedure and related provisions as provided by Terms of Service. ② The Agency may terminate User Agreement or suspend service use without prior notification if a user engages in an act that corresponds to any of the following. 1. In the event that a user steals another person's username or password 2. In the event that a user intentionally interferes with service operation 3. In the event that user's registered information is found to be false (borrowed name, etc.) or is suspected to be with a reasonable cause for doubt 4. In the event that a user violates provisions of Article 9 5. In the event that a user violates obligations as provided in Article 11 6. In the event that a user uploads a post as provided in each subparagraph of Article 12 Paragraph 1 of Terms of Service, or engages in or attempts to engage in other transactions of goods that violate public order or morals 7. In the event that there is a report with specific grounds that a user's activity harms another user's interest such as intentionally not paying purchase prices, Internet fraud, etc. and such report is recognized to be valid based on a reasonable doubt 8. In the event that the same user has double registration with different usernames 9. In the event that a user distributes content that violates public order or morals 10. In the event that a user engages in an act that defames or causes disadvantage to another person 11. In the event that a person sends a large volume of information or transmits advertising information with the purpose of interfering with secure service operation 12. In the event that a user circulates computer virus program, etc. that causes malfunction of telecommunications facilities, destruction of information, etc. 13. In the event that a user violates intellectual property rights of the Agency, another user or a third person 14. In the event that a user uses another person's personal information, username or password through unfair means 15. In the event that a user uploads obscene materials on his/her website or bulletin, or posts link to pornographic websites 16. In the event that a member rejects the Agency's request of consent for revisions in Terms of Service or addition, revision, deletion of content on the 'Platform' with reasonable grounds such as revisions in related statutes, changes in transactional circumstances, improvement of Services, etc. 17. In the event that any ground of termination provided in these Terms of Service occurs or if a user engages in an act that violates these Terms of Service or related statutes such as any act assumed to be related with crimes, act of planning or executing service use for the purpose of harming public interest, act of interfering with the provision of Services, etc. 18. Other events that are found to infringe upon related statutes ③ The Agency may promptly suspend the provision of Services, revoke the user's membership or restrict the user from future participation in the Agency's Services if any of the following grounds is applicable. 1. In the event that the user interferes with the Agency's normal work through violent language, cursing, sexual harrassment, etc. 2. In the event that the user raises complaints intentionally and habitually for the purpose of obtaining unfair gains 3. In the event that the user interferes with the Agency's work by continuously calling the Agency to account regarding matters that the Agency cannot be held legally liable for ④ The Agency shall notify the user of the intention to terminate by clarifying the grounds for termination via e-mail, phone, fax or other means. However, the Agency may grant the user an opportunity to state opinions about the grounds for termination in advance. ⑤ A user of a company that has closed temporarily or permanently may be restricted from using some marketing services including application for project on the Agency's website.

Article 18 (Company's Restrictions in Use)

① In the event that a ground for restriction in use occurs in accordance with Paragraph 2 and 3 of Article 17, the Agency may classify the company that the user belongs to as a company restricted from using the Agency's Services. ② In the event of being classified as a company restricted from use, the user may be restricted from using Services on the 'Platform' including requesting customer service as well as being excluded from the recipient list of marketing information including newsletter, etc. ③ The Agency shall notify the company's user of the intention to restrict use by clarifying the grounds for applying restrictions in use via phone call, e-mail or other means.

Article 19 (Change to Inactive Username)

① The Agency may classify a username that has not used Services including login for 24 months or longer as an inactive username and suspend service use in order to prevent the user's information from being exploited for unlawful purposes and to provide more secure Services. ② The user shall be notified with related information including classification of username as inactive, the date of change to inactive membership, etc. via e-mail, etc. by 30 days in advance of classification as inactive username. ③ In the event of being classified as an inactive username, the user shall be tentatively excluded from the recipient list of marketing information including newsletter. ④ In the event that the inactive user logs into the website again, the user can use the website normally by giving consent to re-activating the username.

Chapter 6. Indemnification

Article 20 (Indemnification Clause)

① The Agency shall not be liable for any information or materials users obtain from using Services. ② The Agency shall not be liable for credibility, accuracy or any other aspect of information, materials or facts posted by users on Services. However, the Agency may reject approval, delete or take other necessary measures when the content of information posted by users is found to defame another person, infringe upon the rights of another person, or violate regulations. ③ The Agency shall not be liable for users' failure to obtain expected gains from the 'Platform' or damages incurred from partial selection or use of Service materials. ④ The Agency shall not be liable for psychological·monetary damages incurred to users by other users while using the 'Platform.' ⑤ Personal information that users post spontaneously and publicly may be collected and used by another person, and the Agency shall not be liable for any risks associated with the above. ⑥ The Agency does not represent or have the authority to control any other websites that users visit through this website. ⑦ The Agency shall not be liable for any damages to users not arising from the Agency's willful misconduct or gross negligence in relation to the use of Services provided by the Agency. ⑧ The Agency merely provides an online transactional venue for mutual transactions between users and does not represent users who sell or purchase goods. Also, no act of the Agency or Platform shall be deemed to be acts to represent Korean companies (vendors) or buyers (purchasers). ⑨ The Agency does provide any guarantee as to whether there is the intention to sell or buy, the authenticity of such intention, the registered goods' quality, integrity, safety, appropriateness or non-infringement of others' rights, authenticity of posted materials, etc. in relation to the purchase or sales between users through the Platform, and respective users shall bear any and all risks and liability related to the above.

Article 12 (Governing Jurisdiction)

① Should a dispute arise related to the use of Services, a legal action shall be brought before the court with jurisdiction under the Civil Procedure Act. ② The governing law for Paragraph 1 shall be the law of the Republic of Korea. ③ Any matters not provided in these Terms of Service or are subject to variability in interpretation shall be handled with consent between the Agency and user. Addendum These Terms of Services take effect as of on December 28, 2020.

Agreement on Collection and Use of Personal Information

Online Business Platform (hereinafter, the "Platform") shall collect the following minimum mandatory information and optional information in the initial sign-up process for sign-up, smooth customer consultation, and provision of various services.

Agreement of Information Subject for Personal Information Protection

Article 1. Purpose of collection and use: for provision of membership service and customized service

(1) Signing up for platform membership and management To confirm intention of signing up for membership; to identify and verify individuals for providing membership service; to maintain and manage membership credential; to provide various notice and information; to handle complaints; etc. (2) Providing goods and services To provide content; to provide customized service; etc. (3) Handling complaints To verify identification of information subject; to contact and notify for fact finding; to notify the outcome of process; etc.

Article 2. Personal information items to be collected

· Mandatory: name of company, corporate registration number, name of representative, address for place of business, corporate phone number, corporate email, name of point of contact (Korean/English), mobile phone number of point of contact, department and title of point of contact, email of point of contact, business type, participating category, corporate registration certificate · Optional: introduction of company, corporate logo, introduction of company

Article 3. Duration for retention and use of personal information

: Upon signing up for the membership to one month after withdrawal from the membership

Article 4. Disadvantages expected when agreement is refused

: If you refuse to agree to the matters related to collection and use, access to the membership service shall be restricted. However, service provision shall not be refused due to the failure of obtaining optional information.

Personal Information Handling Policy

Unless otherwise specified, this policy shall be applicable to all personal information files handled by Korea Energy Agency (hereinafter, the “Agency”). However, if a separate personal information policy is set and implemented by an executing organization for processing its responsible work, such policy shall be followed.

Article 5. Purpose, items, retention period, etc. handling personal information

① The purpose, items, and retention period of personal information files handled and held by the platform are as follows: Basis : Terms of use of platform membership service Purpose : To maintain a system for smooth implementation of program, such as submission of application to participate in the program, provision of information, etc. Collection Methods : Signing up for membership online Personal Information Items : Mandatory: name of company, corporate registration number, name of representative, address for place of business, corporate phone number, corporate email, name of point of contact (Korean/English), mobile phone number of point of contact, department and title of point of contact, email of point of contact, business type, participating category, corporate registration certificate Department and Address Handling Request for Access : Platform operation secretariat Retention Period : One month from withdrawal of membership

Article 6. Personal information protection

According to the related laws and regulations, such as “Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.” and decision made by the Agency, efforts shall be made to protect personal information of “information subject.” Regarding protection and use of personal information, relevant laws and personal information handling policy of the “platform” shall be followed.

Article 7. Provision of personal information to third party

(1) In principle, the platform shall not handle personal information of information subject beyond its original purpose or provide it to any third party. However, in the following cases, personal information can be provided to a third party. ① In the case that a separate information is obtained from the information subject; ② In the case that there are special clauses in laws; ③ In the case that information subject or legal representative is unable to express his/her will or it is not possible to obtain prior consent due to the address unknown, and in the case that it is regarded as urgently necessary for life, body, profit in property of information subject or any third party; ④ In the case that personal information is provided in the form that specific individual is unidentifiable for the purposes of compiling statistics, academic research, etc.; ⑤ In the case that work specified by other laws cannot be performed unless personal information is used other purposes or provided to any third party, and it underwent deliberation and resolution of protection committee; ⑥ In the case that it is necessary to provide to foreign intelligence or international organization to implement treaty and other international agreement; ⑦ In the case that it is necessary for instituting and maintaining prosecution and investigation of crime; ⑧ In the case that it is necessary for proceedings of courts; ⑨ In the case that it is necessary for execution of punishment, preventive custody, and protective disposition; or ⑩ In the case that it is necessary for information protection work, such as verifying irregularities, etc., including but not limited violation of laws and/or violation of this Terms of Service by information subject.

Article 8. Consignment of personal information handling

(1) The platform consigns handling of personal information as follows: - Details of consignment Platform operation : Development and maintenance of system (DB management) Supporting on- and off-line business meetings : Management of online export platform support project - Consigned company Platform operation : ASHER Communication Supporting on- and off-line business meetings : THEYDAY (2) In the consignment agreement, compliance to laws and regulations related to personal information, prohibition of providing personal information to any third party, liabilities, etc. shall be clearly specified and such agreement shall be kept. Also, in the case the consigned company is changed, it shall be informed through personal information handling policy.

Article 9. Rights of information subject and legal representative and means to executing them

(1) Information subject and legal representative can access to and modify their own registered information and request for withdrawal from the membership. (2) After identity verification through “member information management (or my page)” for accessing and/or modifying personal information, or by sending an email to “platform management officer” for cancellation of membership (withdrawal of agreement), information subject may request for accessing his/her information, suspending process of personal information, or correcting or deleting (discarding) information if there is any error. (3) If information subject requests correction for errors in personal information, such personal information shall not be used or provided until the correction is completed. Also, if incorrect personal information is already provided to any third party, the result of correction shall be notified to the third party without delay, so that correction is processed. (4) The platform shall handle the personal information withdrawn or deleted by the request of information subject or legal representative (submitting delegation letter specified Annexed Form No. 11 from the Enforcement Regulations of Personal Information Protection Act) in accordance with “Duration for retention and use of personal information” and shall not allow access or use of such information for any other purposes. (5) Information subject can request for accessing personal information to the below department in accordance with Personal Information Protection Act. After filling out Annexed Form No. 8 from Enforcement Regulations of Personal Information Protection Act, contact to the department in writing, on the phone or via email. Then, request shall be handled without delay. - Department receiving and handling request for accessing personal information :Online business platform secretariat - Responsible personnel : Jeong Yong-cheol, Team Leader - Contact : 02-907-5127 * [Annexed Form No. 8 from Enforcement Regulations of Personal Information Protection Act] Request for Personal Information (Access, Modification and Deletion, Suspension of Handling) * [Annexed Form No. 11 from Enforcement Regulations of Personal Information Protection Act] Delegation Letter

Article 10. Safety measures for personal information

The platform comes up with following safety measures to secure safety, so that personal information is not lost, stolen, leaked, altered or damaged in handling personal information of information subjects. (1) Establishment and implementation of internal management plan Establishment and implementation of internal management plan of the platform shall be done in accordance with internal management policy of Ministry of the Interior. (2) Minimum number of personnel handling personal information and their training Handling personal information on the platform is restricted to the responsible personnel, and separate password is assigned and regularly renewed. Also, through regular training for the responsible personnel, compliance to personal information protection policy is always emphasized. (3) Restriction of access to personal information In handling personal information, necessary measures are being taken to restrict access to personal information by giving, changing and discarding privilege to access to database system. By using firewall system, unauthorized access from the outside is controlled. (4) Encryption of personal information ID and password of information subject are stored and managed in an encrypted form and only information subject holds this information. Access to and change of personal information is possible only by the information subject who is aware of password. Also, important data is transferred and stored with extra security by encrypting them. (5) Storing and checking access log The record of accessing personal information processing system (web log, summary information, etc.) is kept and managed for at least six months to prevent forgery, theft and/or loss. In order to respond to leakage, forgery, damage, etc., access log, etc. is inspected at least once every six months. (6) Prevention of malicious programs, etc. GobizKOREA is doing its best to prevent leakage and damage of personal information of members from happening caused by hacking or computer virus. Also, it controls unauthorized external access by using firewall system. With other systems, it is trying its best to be equipped with all possible technological devices requiring to ensure security. (7) Physical access control Personal information system storing personal information has a physical storage space, and access control procedure is established and being operated.

Article 11. Personal information discarding procedure and methods

In principle, personal information shall be discarded without delay once the purpose of collecting and using such personal information is fulfilled. Personal information discarding procedure and methods of the platform are as follows: (1) Discarding procedure The information entered by information subject to sign up for membership shall be moved to a separate DB (a separate cabinet for information on paper) upon fulfillment of the purpose of such information, and it shall be discarded after three years of storage in accordance with internal policy and other relevant laws and regulations. Such personal information shall not be used for any other purposes unless it is required by laws. (2) Discarding methods Personal information printed on paper shall be discarded by shredding it with shredder or incinerating it. Personal information stored in an electronic form shall be deleted with technological means that cannot restore the record.

Article 12. Personnel responsible for personal information and contact

The platform designates and operates personal information protection officer to promote protection of citizens’ rights and appropriate implementation of public work by ensuring legitimacy of personal information and appropriateness of procedure. When you identify potential leakage of personal information held by the Korea SMEs and Startups Agency or have concern over violation of rights of information subject, please inform to the following contact. (1) Personnel responsible for personal information protection Name: Jeon So-hee Title/Position: Deputy General Manager Email: ssoi20@energy.or.kr Phone number: 052-920-0302 To ensure that personal information collected in accordance with laws and regulations are used for the purposes of collection and handling, guidance and supervision shall be always maintained.

Article 13. Change in personal information handling policy

Notice shall be omitted when there is any change due to the change in the number of personal information files. This personal information handling policy shall take effective from 28 Dec. 2020.